Switchable Authorization checks for RFC in Handling Unit Management, SAP security note 2537935

SAP security note 2537935, "Switchable Authorization checks for RFC in Handling Unit Management". Below are the symptom and SAP recommended solution.

Description

Symptom

S_RFC authorization checks are insufficient to ensure the secure execution of RFC function modules within Handling Unit Management (LO-HU) in SAP ERP SCM Logistics. This vulnerability allows unauthorized access and actions if exploited.

Solution

Implement new switchable authorization checks to enhance the security of RFC function modules in Handling Unit Management. These checks are delivered inactive by default to maintain system compatibility and can be activated manually via transaction SACF.

• Activate New Authorization Checks: Use transaction SACF to activate the new authorization scenarios. Refer to the attached manual correction instructions for detailed guidance.
• Maintain New Messages: Navigate to transaction SE91. Update the message class and number as specified in the manual instructions to ensure proper authorization error handling.
• Update Authorization Defaults: Option A: Upload the SU22_EBJ_20170929.TXT file using transaction SU22 to update authorization defaults. Option B: Run the UDO report NOTE_2537935 to upload the necessary authorization scenario definitions.
• Assign Scenario Definitions: Use transaction SACF_TRANSFER to upload scenario definitions from the SACF_DATA.TXT file. Assign the scenarios to the development package HU_BOR.
• Post-Implementation Actions: After importing the note, perform the manual post-implementation steps in each system to activate the checks.

Reason and prerequisites

Remote function calls (RFC) are typically protected by the S_RFC authorization object. However, these checks alone are not adequate for certain RFC function modules, which may lack additional functional authorization checks. As a result, unauthorized users might execute sensitive functions, compromising system security.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• SAP Note 2216306 – S_RFC check and profile parameter auth/rfc_authority_check
• SAP Note 2008727 – Securing Remote Function Calls (RFC)
• SAP Note 1922808 – SACF | FAQ | Supplementary information about the application
• Error in BAPI_HU_PROCESS_MSG – this document is causing side effects